CVE-2026-57660: Unauthenticated Broken Access Control in Booking and Rental Manager

Technical summary

CVE-2026-57660 is a broken access control vulnerability (CWE-862) in Booking and Rental Manager affecting versions 2.7.1 and below. The vulnerability permits unauthenticated access to modify application data. The CVSS 3.1 score of 5.3 (MEDIUM) reflects network-based attack complexity with no authentication requirement, limited integrity impact, and no confidentiality or availability compromise. The attack surface is unrestricted (no physical access or user interaction needed), suggesting the flaw exists in a web-facing or API endpoint that fails to enforce proper authorization checks before state-changing operations.

Business impact

This vulnerability directly threatens the integrity of booking and rental data. Organizations relying on Booking and Rental Manager face risks of unauthorized modifications to reservations, pricing, customer information, or availability calendars—potentially causing operational disruption, customer dissatisfaction, revenue loss, or financial reconciliation issues. While the vulnerability does not expose sensitive data or cause system outages, it enables adversaries to corrupt or manipulate the core business function the application serves, which could erode customer trust and complicate audit compliance.

Affected systems

Booking and Rental Manager versions 2.7.1 and earlier are affected. Organizations using this software should immediately verify their deployment version. The vulnerability requires no special environment configuration or uncommon features; any deployment running a vulnerable version is at risk.

Exploitability

This vulnerability has a low barrier to exploitation. No authentication, special privileges, or user interaction is required—an attacker with network access can craft and send requests directly to vulnerable endpoints. The low attack complexity and absence of authentication checks mean that opportunistic scanning and exploitation are plausible threats. However, the vulnerability is not currently tracked on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting limited active real-world exploitation at the time of publication, though this does not eliminate the need for prompt remediation.

Remediation

Upgrade Booking and Rental Manager to a version patched after 2.7.1. Consult the vendor's official security advisory or release notes to confirm the minimum patched version. In environments where immediate patching is not possible, apply network-level access controls to restrict direct requests to the vulnerable endpoints, and monitor for suspicious or unauthorized state-changing operations on booking and rental data.

Patch guidance

Contact the Booking and Rental Manager vendor or consult their security advisories to obtain the patched version released after 2.7.1. Test the patch in a non-production environment before deployment to ensure compatibility with your rental and booking workflows. Given the MEDIUM severity and integrity-only impact, patch deployment should be completed within 30–60 days, prioritizing production systems that handle critical customer bookings.

Detection guidance

Monitor application logs for unusual POST, PUT, or DELETE requests to booking or rental management endpoints that originate from unauthenticated sessions or lack proper authorization headers. Implement API request logging to track modifications to rental inventory, reservation records, or pricing data. Anomalies might include bulk data changes, modifications outside normal business hours, or requests from unexpected network origins. Web application firewalls (WAFs) can be configured to require authentication tokens before permitting state-changing operations on sensitive endpoints.

Why prioritize this

Although rated MEDIUM severity and not currently on the KEV catalog, this vulnerability warrants prompt attention because it directly compromises the integrity of core business data (bookings and rentals) with no authentication barrier. The ease of exploitation and absence of user interaction requirements mean that even opportunistic threat actors could discover and abuse this flaw. Organizations should treat this as a near-term patch priority, particularly if the application is internet-facing or accessible from untrusted networks.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a low attack vector requirement and no authentication complexity, balanced against limited scope of impact—data integrity is compromised but confidentiality and availability remain intact. The MEDIUM rating appropriately characterizes a flaw that enables unauthorized modification without exposing secrets or causing outages. The unauthenticated network accessibility and direct impact on business-critical data elevate the operational risk above the base CVSS score, justifying prioritized remediation despite the 5.3 numerical rating.

Frequently asked questions